gitea serves the registry's public root, and the lab trusts a tarball only at it or the forge's own origin (hq ADR 0346, issue 624)

The forge writes every tarball at its public name and the lab reaches it at
a private address, so npm 12 refused every locked @novox package. The public
name now comes from the mesh's own composition of the forge's route, through
the lab's binding, and the lab compares scheme, host and port.

modules/gitea/README.md

@@ -4,6 +4,13 @@ The forge, and the mesh's npm package registry: it claims the `git` and `npm-pac
 Its tools, its events and the provisioner of registry accounts are the TypeScript bundle (`index.ts`,
 `tools/`, `provisioner/`). This README covers the two Go bundles beside it.
 
+**What a registry consumer is told** (`serves.npm-package-registry`): where the registry answers on the
+private network (`scheme`, `port`, `npm-path`), and its `public-root`, the address the forge writes every
+tarball at: `https://` and the forge's route's composed public name, under the npm path
+(`${bound:route:name-web}`, novox/hq ADR 0346). A lock file holds that address, and npm 12 installs a
+locked tarball only from the registry it is configured with, so a consumer that installs from lock files
+trusts that root. On a machine with no public domain the key is left out, and the plan says so.
+
 ## Announcing pull requests to the merge check (novox/hq to-be 45 §9, issue 347)
 
 Every new head of an open pull request is announced as `pull.updated`, once, and the controller has it checked.

modules/gitea/module.json

@@ -68,7 +68,8 @@
     "npm-package-registry": {
       "scheme": "http",
       "port": 3000,
-      "npm-path": "/api/packages/novox/npm/"
+      "npm-path": "/api/packages/novox/npm/",
+      "public-root": "https://${bound:route:name-web}/api/packages/novox/npm/"
     },
     "git": {
       "scheme": "http",